Privacy Policy
This Privacy Policy explains how Prime Savers (ABN 80 435 179 137) (“SplitYa”, “we”, “us”, “our”) collects, uses, stores and discloses your personal information when you use the SplitYa website and application (the “Service”). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where they apply to you, other data-protection laws such as Brazil’s LGPD and the EU/UK GDPR (see section 1).
1. Who this applies to — your location and rights
SplitYa is operated from Australia by Prime Savers and is designed primarily for users in Australia, where we handle personal information under the Privacy Act 1988 (Cth) and the APPs. SplitYa may, however, be used by people in other countries. If you access the Service from outside Australia, additional data-protection laws may apply to you, and we extend the following rights to you where those laws apply:
- Users in Brazil (LGPD — Lei nº 13.709/2018). You may request: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data; data portability; and information about who we share your data with and about your option to refuse consent and its consequences. Where processing is based on consent, you may withdraw it. You may also request a review of decisions made solely by automated processing that affect you.
- Users in the EU / UK (GDPR). You have the rights of access, rectification, erasure, restriction of processing, data portability, and to object to processing, and the right to lodge a complaint with your local supervisory authority.
To exercise any of these rights, contact us using the details in section 16. We do not charge for reasonable requests and aim to respond within 15 days, or as otherwise required by the law that applies to you.
2. Information we collect
| Category | Examples |
|---|---|
| Account | Name, email address, and (via Google sign-in) your Google profile basics. Location/timezone you set. |
| Financial data you enter | Salary/income, budget percentages, expenses, recurring bills, debts, savings goals, group and settlement records. |
| Shared-cost data | Names, emails, mobiles or PayID identifiers of mates or a partner that you choose to add. |
| Uploaded content | Receipt images/PDFs and voice transcripts you submit for scanning. |
| Payment data | Subscription status and a Stripe customer/subscription reference. Card details are collected and stored by Stripe, not by us. |
| Technical | Device/browser information, and data stored locally in your browser (e.g. session and preference caches) to run the app. |
3. How we collect it
We collect information directly from you when you create an account, complete onboarding, enter data, upload receipts, or subscribe. We also collect information from providers you authenticate with (Google) and from our payment processor (Stripe) about your subscription status.
4. Why we collect and use it
- To provide, personalise and operate the Service (budgets, splitting, insights, reminders).
- To process subscriptions and payments.
- To extract details from receipts and voice commands you submit.
- To communicate with you about your account, security, and service updates.
- To maintain security, prevent fraud and misuse, and comply with legal obligations.
5. Legal bases for processing (users in Brazil / EU)
Australian privacy law does not require us to identify a specific “legal basis” for each use. For users protected by the LGPD (Brazil, Art. 7º) or the GDPR (EU/UK), the bases we rely on are:
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, account basics | Create your account, sign-in, deliver the Service and communicate about it | Performance of a contract |
| Financial data you enter | Provide the budgeting, splitting and insight features you ask for | Performance of a contract |
| Shared-cost data (mate/partner name, email, mobile, PayID) | Let you split and settle costs with people you add | Performance of a contract |
| Uploaded content (receipts, voice transcripts) | Extract merchant, items, amounts and dates when you submit them | Performance of a contract |
| Payment data (subscription status, Stripe reference) | Process your subscription and keep tax/accounting records | Performance of a contract; legal obligation (tax) |
| Technical / device data | Run the app, keep you signed in and maintain security | Legitimate interest / performance of a contract |
| Any future analytics or marketing | Understand usage or send promotional messages | Consent (opt-in) — not used unless and until you agree |
Because these uses are needed to provide the Service you signed up for, they continue for as long as your account is active, independently of any separate marketing consent you may give or withdraw.
6. Who we share it with
We do not sell your personal information. We share it only with service providers who help us run the Service, under contract and only as needed:
| Provider | Purpose |
|---|---|
| Stripe | Payment processing and subscription management. |
| Google Firebase | Account authentication (sign-in). |
| Supabase | Secure hosting of your app data. |
| Google (Gemini) | AI processing of receipt images and voice transcripts you submit, to extract merchant, items, amounts and dates. |
We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety and property of SplitYa or others.
7. International data transfers
SplitYa is hosted in Australia, but several of our providers process data on servers located overseas — including outside Australia and outside Brazil. In particular, Stripe, Google (Firebase and Gemini) and Supabase may process your data in the United States, the European Union or other regions. Where we transfer personal information internationally, we take reasonable steps to ensure it is protected consistently with the law that applies to you (for Australia, the APPs; for Brazil, LGPD Art. 33; for the EU/UK, GDPR Chapter V), including through our providers’ data-processing agreements and safeguards such as standard contractual clauses. [confirmar com advogado: mecanismo de salvaguarda exato — cláusulas-padrão / DPAs dos provedores / adequação do país.]
8. Security
We take reasonable steps to protect your information, including access controls (row-level security so you can only access your own records), encrypted connections, and delegating card handling to Stripe. No system is completely secure; we cannot guarantee absolute security, and you are responsible for keeping your login credentials safe.
9. Data breaches
We maintain a process to detect, contain, assess and respond to security incidents. Where a data breach is likely to result in serious harm, we will notify the affected individuals and the relevant authority as required by the law that applies — in Australia, the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme; for affected users in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD) under LGPD Art. 48 — within a reasonable time, with clear information about what happened and what you can do.
10. Cookies and local storage
The Service uses your browser’s local storage and similar technologies to keep you signed in and remember your preferences and cached data so the app works. These are essential to the Service’s functionality. We do not currently use non-essential analytics or advertising cookies; if we introduce any in future, we will ask for your consent (opt-in) before using them, where the law requires it.
11. Retention
We keep your personal information for as long as your account is active and as needed to provide the Service. If you delete your account, we will delete or de-identify your personal information within a reasonable period, except where we are required to retain it by law (for example, records relating to payments, which are kept for the statutory period).
12. Your rights
In addition to the rights described in section 1 for your location, you can:
- Access & correction. View and edit most of your information in the app, and request access to or correction of your personal information.
- Deletion. Request deletion of your account and associated personal information by contacting us.
- Portability & export. Paid plans can export their data from within the app; you may also request a copy of your information in a structured, machine-readable format.
- Withdraw consent & object. Where we rely on your consent (for example, marketing), you can withdraw it at any time, and you can object to certain processing. Withdrawing marketing consent does not affect your access to the Service, which relies on a separate basis (performance of the contract).
13. Children
The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children.
14. Complaints
If you have a privacy concern or complaint, contact us at primesavers@hotmail.com and we will respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you are in Brazil, you may also contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
15. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here with a new “last updated” date and, for material changes, take reasonable steps to notify you.
16. Contact
Prime Savers (operator of SplitYa)
Privacy, LGPD and international data requests: primesavers@hotmail.com
[confirmar com advogado: é necessário nomear um Encarregado/DPO (LGPD Art. 41)? Se sim, incluir nome e canal de contato aqui.]